Bayhealth Data Breach Settlement: Eligibility, Claims, and Deadlines

If you got a notice from Bayhealth Medical Center about the July 2024 ransomware attack, you can file a claim under the $2.5 million Bayhealth data breach settlement by April 20, 2026. Approved claimants can choose a pro rata cash payment of roughly $60, reimbursement of up to $5,000 in documented losses, or two years of credit and identity monitoring. The case, Dunlop, et al. v. Bayhealth Medical Center, Inc. (No. N25C-10-167), received preliminary approval from the Delaware Superior Court in December 2025, and a final approval hearing is set for June 5, 2026.¹²

Who Qualifies

The class covers all U.S. residents whose personal information was potentially compromised in the incident and who received a notice from Bayhealth. Members are identified on a list Bayhealth prepared, and each notice carries a unique class member ID used for filing. Bayhealth reported the breach to the U.S. Department of Health and Human Services as affecting 497,047 individuals.³²

Judges assigned to the case, Bayhealth and its subsidiaries and parent entities, and anyone who submits a valid opt-out by March 23, 2026 are excluded.²

What You Can Claim

The settlement offers three benefits. You may claim both a cash payment and out-of-pocket reimbursement, but the credit monitoring option is a separate election.

Pro rata cash payment. An estimated $60 per approved claim, adjusted up or down based on the number of claims filed. No documentation is required.⁴

Out-of-pocket loss reimbursement. Up to $5,000 for documented expenses tied to the breach. Covered costs include identity theft losses, credit monitoring services purchased after July 31, 2024, and related fees such as notary or postage. You need to provide receipts or other supporting records and confirm the expenses were not reimbursed elsewhere.⁴

Medical monitoring services. Two years of one-bureau credit monitoring, dark web monitoring, real-time inquiry alerts, and $1 million in identity theft insurance. If settlement funds run short, the monitoring period may be reduced to one year. Activation codes will be sent within 14 days of final approval and must be used within 180 days.⁴

If total approved claims exceed the fund, payments are reduced proportionally. If out-of-pocket claims alone exhaust the fund, no pro rata cash payments will be made.⁴

How To File

You can file online at the official settlement website or mail a completed claim form to the settlement administrator, Kroll Settlement Administration LLC. Online filing requires the unique class member ID printed on your mailed notice. All claims must be submitted online or postmarked by April 20, 2026.²⁵

Questions can go to the administrator at (833) 754-4833 or through the contact form on the settlement website.⁴

Key Dates

March 23, 2026: Deadline to opt out of the settlement or file a written objection. Both must be mailed and postmarked by this date.⁶
April 20, 2026: Deadline to submit or postmark a claim.²
June 5, 2026, 10:00 a.m. ET: Final approval hearing before Judge Francis J. Jones Jr. in Delaware Superior Court. The court has not yet decided whether to grant final approval.²

If you do nothing, you stay in the class and give up the right to sue Bayhealth over the incident, but you also receive no payment or monitoring benefit. Opting out preserves your right to sue on your own. Objecting keeps you in the class but tells the court why you disagree with the terms.²

What The Breach Involved

Bayhealth detected suspicious activity on its network on July 31, 2024. A forensic investigation determined that an unauthorized actor had access to Bayhealth systems from July 27 through July 31, 2024. The compromised data included names, Social Security numbers, driver’s license numbers, medical information, and health insurance information.³

The Rhysida ransomware group claimed responsibility and demanded 25 Bitcoin, worth roughly $1.4 million at the time.⁷ According to the lawsuit, some data, including passports, Social Security numbers, and email addresses, was later published on Rhysida’s dark web leak site in August 2024. Whether Bayhealth paid the ransom has not been publicly confirmed.⁸

The complaint alleged Bayhealth failed to implement reasonable safeguards and did not comply with HIPAA security rules or FTC guidelines, and it raised claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, and breach of fiduciary duty. Bayhealth denies any wrongdoing and agreed to the $2.5 million settlement to resolve the case.³

From the $2.5 million fund, class counsel from Kopelowitz Ostrow P.C. and Strauss Borrelli PLLC have requested attorneys’ fees of up to one-third of the fund (approximately $833,333) plus litigation costs, and the three named plaintiffs have each requested a service award of up to $5,000. Both requests are subject to court approval and would reduce the amount available for claimants.⁴

1
Delaware Online. Bayhealth Data Breach $2.5M Settlement Plan Pending Court Approval
2
Bayhealth Data Incident Settlement. Bayhealth Data Incident Settlement
3
HIPAA Journal. Bayhealth Medical Center Data Breach Settlement
4
Bayhealth Data Incident Settlement. FAQ
5
ClassAction.org. $2.5M Bayhealth Medical Center Settlement Ends Litigation Over Data Breach Discovered July 2024
6
Bayhealth Data Incident Settlement. Documents
7
Healthcare IT News. Rhysida Claims Bayhealth Hospital Breach
8
Delaware Online. Bayhealth Data Held for Ransom, Lawsuit Alleges Breach